OTTAWA — The federal privacy commissioner will receive on Friday the findings of an internal investigation into an embarrassing loss of sensitive information of approximately 800 current and former federal employees.

The data breach at the Office of the Privacy Commissioner of Canada is believed to have happened in February, after employees lost an unencrypted hard drive containing the private information of past and current employees, while moving their headquarters to Gatineau, Que. from Ottawa.

The lost information dates back to 2002 and includes employee names, salaries, internal ID numbers, other payment information and job classifications for both current and former employees in the Office of the Privacy Commissioner and the Office of the Information Commissioner.

“The words that really capture it best is that it is humbling,” interim Privacy Commissioner Chantal Bernier said Thursday in an interview with the Citizen. “We’ve already learned a lot from this incident.”

Current employees in the offices of the privacy and information commissioners were notified of the data breach during a staff meeting on April 17. The federal Treasury Board department, Speakers of the House of Commons and Senate, and the chair of the Commons information and privacy committee were also notified the same day.

Bernier said her office has not yet issued a press release on the breach because they are still in the process of contacting hundreds of former employees.

The office is planning an independent external review of the incident and has referred the file to ad hoc Privacy Commissioner John Sims, a former deputy attorney general of Canada. Sims is responsible for investigating complaints against the privacy commissioner’s office.

Bernier said the RCMP has not been asked to investigate because the office doesn’t believe the hard drive was taken for malicious purposes. The hard drive is not easily readable and contains mostly codes, she said.

“There is absolutely no value to this information for any criminal purpose you can think of,” she said.

While the lost data date back 12 years, this sort of information is only supposed to be held for seven years, according to an email to staff.

The lost external hard drive had been attached to one of the office’s servers in downtown Ottawa, before it disappeared during the move to the Gatineau office Feb. 14.

Staff noticed the hard drive was missing in mid-March, then realized on April 9 that it contained personal information. Bernier was notified the next day and called for an internal review.

Senior Parliament Hill reporter for the Ottawa Citizen, politics junkie, wannabe pro golfer and someone who has wordsmithed at newspapers in Ontario, Alberta and Saskatchewan. I've covered politics at... read more every level, including city hall in Ottawa and Calgary, the Alberta legislature in Edmonton and now back in Ottawa covering the Hill.View author's profile